fix(safe-css): accept registered blur variable

TASK_PROGRESS.md

@@ -1,6 +1,27 @@
 # Task Progress
 
-Updated: 2026-07-25 08:31 HKT (Asia/Hong_Kong)
+Updated: 2026-07-28 16:16 CST (Asia/Shanghai)
+
+## Safe CSS backdrop-filter variable fix (2026-07-28)
+
+- [in progress] Worktree `/Users/yeelight/Desktop/workspace/ai/Codex-Dream-Skin-safe-css-fix`
+  on branch `codex/fix-safe-css-backdrop-var`, based on `upstream/main@611c101`.
+- [complete] Reproduced the public `0.1.1` theme failure against the client Safe CSS
+  validator. The package contains `blur(var(--ds-theme-surface-blur))`, which is a
+  registered contract value but cannot match the client's non-nested blur regex.
+- [complete] A cross-platform regression now accepts the registered blur variable
+  and still rejects an unrelated registered variable. The canonical runtime
+  validator minimally captures the nested function argument, and the generated
+  macOS/Windows copies are byte-identical.
+- [verified] Safe CSS tests passed 9/9; all portable macOS Node tests passed 54/54;
+  all portable Windows Node tests passed 17/17; both injector payload checks,
+  runtime asset sync check, `git diff --check`, and the applicable macOS repository
+  suite passed. The real public `0.1.1` market package validates as the official
+  format through both platform validators. Full-Xcode, installed signed-runtime,
+  and Doctor integrations were environment skips. This macOS host has no
+  PowerShell, so PowerShell 5.1/7 remain explicit PR CI gates.
+- [approved] Explicit approval was received to commit the reviewed five-file
+  change, push the feature branch, and open the upstream pull request.
 
 ## v1.5.1 Version Release (2026-07-25 08:28 HKT)
 

macos/assets/safe-css-validator.mjs

@@ -278,7 +278,7 @@ function validatePropertyValue(property, value) {
   }
   if (property === "backdrop-filter") {
     if (value.toLowerCase() === "none") return true;
-    const match = value.match(/^blur\(\s*([^\s)]+)\s*\)$/i);
+    const match = value.match(/^blur\(\s*(.+?)\s*\)$/i);
     return Boolean(match && (
       registeredVar(match[1], new Set(["--ds-theme-surface-blur"]))
       || zeroOrPx(match[1], 0, 20)

macos/tests/safe-css-validator.test.mjs

@@ -68,6 +68,25 @@ test("accepts only the bounded public part/property/value contract", () => {
   }
 });
 
+test("accepts the registered surface blur variable inside backdrop-filter", () => {
+  const source = `[data-ds-part="sidebar"] {
+  backdrop-filter: blur(var(--ds-theme-surface-blur));
+}`;
+  for (const validator of validators) {
+    assert.deepEqual(validator.validateSafeCss(source), {
+      contract: "dreamskin-safe-css/1",
+      status: "validated",
+      bytes: new TextEncoder().encode(source).length,
+      ruleCount: 1,
+      declarationCount: 1,
+    });
+  }
+  assertRejected(
+    `[data-ds-part="sidebar"] { backdrop-filter: blur(var(--ds-theme-surface-radius)); }`,
+    "value/unsupported",
+  );
+});
+
 test("rejects selector escape, global reach, DOM coupling, and unregistered parts", () => {
   for (const source of [
     `:root { color: #fff; }`,

runtime/safe-css-validator.mjs

@@ -278,7 +278,7 @@ function validatePropertyValue(property, value) {
   }
   if (property === "backdrop-filter") {
     if (value.toLowerCase() === "none") return true;
-    const match = value.match(/^blur\(\s*([^\s)]+)\s*\)$/i);
+    const match = value.match(/^blur\(\s*(.+?)\s*\)$/i);
     return Boolean(match && (
       registeredVar(match[1], new Set(["--ds-theme-surface-blur"]))
       || zeroOrPx(match[1], 0, 20)

windows/assets/safe-css-validator.mjs

@@ -278,7 +278,7 @@ function validatePropertyValue(property, value) {
   }
   if (property === "backdrop-filter") {
     if (value.toLowerCase() === "none") return true;
-    const match = value.match(/^blur\(\s*([^\s)]+)\s*\)$/i);
+    const match = value.match(/^blur\(\s*(.+?)\s*\)$/i);
     return Boolean(match && (
       registeredVar(match[1], new Set(["--ds-theme-surface-blur"]))
       || zeroOrPx(match[1], 0, 20)